fix(update): put back the two things the PowerShell helper did

Operators are still losing the relaunch, so I went and read the code
from before 0430aab — the commit that removed the helper — instead of
theorising again. It was:

  Wait-Process -Id <pid>; Start-Sleep -Milliseconds 400;
  Start-Process -FilePath <exe> -ArgumentList '--post-update'

Two things in there that the direct launch never had:

1. Start-Process made the new OpsLog a child of PowerShell, which then
   exited — so it was detached. The direct launch makes it a child of
   the instance that is dying, in the same process group and console.
   DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP puts it back on its own,
   so nothing aimed at the old process can reach the new one.

2. It slept 400 ms AFTER the old process was gone, before starting
   anything. A process's handles are released by the kernel as it dies,
   so the mutex is free the moment the wait returns — but the things
   around it are not on that clock: the WebView2 user-data lock, the log
   file, an antivirus that woke up when the exe was replaced. This is
   not a theory about which of those it was; it is the pause being put
   back where it was.

Not restored: the PowerShell itself. Defender removed 0.27.14 from a
station as Trojan:Script/Wacatac.H!ml, and "Script/" was that helper —
an unsigned binary replacing itself and spawning a windowless script to
start another executable is, byte for byte, a dropper. Bringing it back
trades this fault for one that deletes the program.

Also: the relaunch now logs the child's pid, which the new instance's
startup.log already records on the other side. Without the pair there is
no telling "the new instance never started" from "it started and gave up
waiting", and those have different causes.

update.go

@@ -243,8 +243,15 @@ func (a *App) DownloadAndApplyUpdate(url string) error {
 	// differing by one line is how only one of them was broken.
 	cmd := relaunchCmd(exe, "--post-update", "--wait-pid", strconv.Itoa(os.Getpid()))
 	if err := cmd.Start(); err != nil {
+		applog.Printf("update: the relaunch could not be started: %v", err)
 		return fmt.Errorf("schedule relaunch: %w", err)
 	}
+	// The child's pid, named in BOTH logs — this one and the new instance's
+	// startup.log, which records the pid it was told to wait for. Without the
+	// pair there is no way to tell "the new instance never started" from "it
+	// started and gave up waiting", and those have different causes.
+	applog.Printf("update: relaunch started as pid %d, waiting for this one (pid %d) to exit",
+		cmd.Process.Pid, os.Getpid())
 	// Released rather than waited on: this process is about to exit, and a child
 	// that outlives its parent must not be left as a zombie handle.
 	_ = cmd.Process.Release()